The new Facebook Graph Search – part 1

WARNING: This is a long read. We just couldn’t make it shorter, sorry… Take your time, get comfortable and dive into the new way of Facebook Graph Search!

R.I.P Graph Search – June 7th 2019

As you might have noticed, on June 7th 2019, Facebook shut down its Graph Search options. Within a few hours people found solutions but, unfortunately, it didn’t seem to last long. Since August 1st, there seems to be a steady solution.

The ‘new’ Graph Search seems a little comprehensive at first, but it’s pretty easy once you get the hang of it. It involves some JSON and Base64, languages not everyone is familiar with. But even though you might have even never heard of these concepts, you can still build the Graph queries! In fact, we made a whole other blog post about JSON, Base64 encoding, and URL encoding to prep you for these Facebook changes.

Of course there are tools and websites like Graph.tips, Sowdust, and Intelx.io which do a great job of simplifying the “how do I get this Facebook data…” questions, but it’s always better to know how these tools work instead of relying on them. As we have seen recently, web sites and their tools come and go. Understanding HOW something works helps you even when our favourite tools stop working. And understanding how these tools work helps you stay OSINT curious too :)!

Before we start…

Just like in the ‘old’ Graph Search, ID numbers are still important. You can find a Facebook ID number very easily by following these instructions:

Open the page or profile of interest in a web browser

Right click somewhere on the page where there is no content (mostly in the light grey area’s) and choose ‘View page source’ (or use Ctrl+U. This works in most browsers.)

Search, using Ctrl+F, for ‘entity_id’ (when looking at a profile), ‘page_id’ (when looking at a page) or ‘group_id’ (when looking at a group). The number mentioned just behind ‘entity_id=’ or ‘page_id=’ is the number you need to copy.

Example of the ‘page_id:’ of the Google Netherlands Facebook page

Also, don’t forget to switch your Facebook language settings to ‘English US’ in order to get the best results.

Searching Facebook

According to an article on Buzzfeed, Facebook stated: “The vast majority of people on Facebook search using keywords, a factor which led us to pause some aspects of graph search and focus more on improving keyword search. We are working closely with researchers to make sure they have the tools they need to use our platform.“

And I must say, their keyword search has improved. While searching the regular search bar at the top of Facebook (visible when logged on), Facebook offers a wide range of filters to choose from. Give it a try, it has already surprised me a couple of times!

Red box on top: select a category you want to search inRed box on the left: filter the results as you like

Don’t forget to log on to Facebook in order to use the search options. If you struggle with creation or maintaining a research profile, check out one of our previous blogpost on sock puppets.

Searching with the ‘new’ Graph Search

Buckle up readers! This is where the ride really starts; get comfortable and keep on reading for the comprehensive part!

Even though the search bar works pretty well, you sometimes want to specifically filter on the things you are interested in. For example; ‘Most Recent’ posts on a specific topic. This is not a standard option, although the option is still available. You just have to put in a little more effort.

The base

For every search the base will always be this URL:

facebook.com/search/top/?q=people&epa=FILTERS&filters=

In this URL we’re going to adjust somethings and add somethings at the end. We’re going to start with selecting the right category you want to search in. For adjusting the category, you change the highlighted part (“top/”) in one of the categories mentioned below:

facebook.com/search/top/?q=people&epa=FILTERS&filters=

These are the categories to choose from:

URL Parameter

What it does

top/

Search top content

posts/

Search public posts

people/

Search for people

photos/

Search for photos

videos/

Search for videos

pages/

Search for pages

places/

Search for places

Now you know how to change the category, we can take a look at changing the search query. Changing the search query is done in the highlighted part of the URL:

facebook.com/search/top/?q=people&epa=FILTERS&filters=

Change ‘people‘ into whatever you’re searching for. Searching for more than one word? Just keep typing, the spaces will change into ‘%20’. Or type a ‘+’ between the words. (E.g. ‘osintcurious+technisette’ or ‘John+Doe‘ or ‘Ford+Mustang+Red‘).

Attention: You always have to fill in a query. You can’t leave it blank.

So now you know how to change the category and how to change the search query. We’re half way there!

The next step

We’re going to dive into JSON and Base64 now. Don’t be scared! I don’t ‘speak’ or ‘write’ any of these data formats and I was still able to find out how it works. So stick with me please :)! Again, we have a primer for this on our other blog. Check it out!

We’re going to add the last piece to our URL. The best way to explain this is by using an example. Let’s say you want to search for the most recent posts on the topic ‘baseball’. Our URL will look like this:

facebook.com/search/posts/?q=baseball&epa=FILTERS&filters=

‘search/posts/‘ because we want to find public posts.‘?q=baseball‘ because this is our search query.

To find the ‘Most recent’ posts, we have to translate a JSON string into Base64. The JSON string for ‘Most recent’ is:

{“rp_chrono_sort”:”{\”name\”:\”chronosort\”,\”args\”:\”\”}”}

To translate JSON into Base64, we’re going to use CyberChef. This is a free online tool and very easy to use. (In our previous post we show you how to use CyberChef for many other things too. Also; there are more tools to help you translate JSON to Base64. Pick whatever tool you’re most comfortable with.)

Choose ‘To Base64’ form the Operations section. Drag this option to the Recipe section and drop.

The ‘Input’ field is blank. Make sure to paste the JSON line, as mentioned above, in this Input field.

You’ll now see the result in the ‘Output’ field. (If you don’t immediately see a result, make sure to check if the ‘Auto bake’ box is ticked.)

Copy the Base64 Output.

Explanation on how to use CyberChef to ‘bake’ JSON to Base64

So we’ve now put a JSON line to Base64. The result of the JSON line for ‘Most recent’ will look like this:

Possible options per category

As @djnemec explained in his post, there are a couple of options to filter per category. We’ve summed up the possible options and translated some of them to Base64. This does not go for all options; for some options you’ll need the specific Facebook ID. If you don’t know how to retrieve the ID, scroll up for an explanation.

I must say that some of them have brought me better results than the regular search Facebook offers and some of them have shown me less content. So make sure to keep trying, stay (osint)curious and test queries!

Search/top/ (searching for most popular content)

Most recent popular contentJSON: {“rp_chrono_sort”:”{\”name\”:\”chronosort\”,\”args\”:\”\”}”}Base64: eyJycF9jaHJvbm9fc29ydCI6IntcIm5hbWVcIjpcImNocm9ub3NvcnRcIixcImFyZ3NcIjpcIlwifSJ9

Most popular public contentJSON: {“rp_author”:”{\”name\”:\”merged_public_posts\”,\”args\”:\”\”}”}Base64: eyJycF9hdXRob3IiOiJ7XCJuYW1lXCI6XCJtZXJnZWRfcHVibGljX3Bvc3RzXCIsXCJhcmdzXCI6XCJcIn0ifQ==

Most popular content posted from your own profileJSON: {“rp_author”:”{\”name\”:\”author_me\”,\”args\”:\”\”}”}Base64: eyJycF9hdXRob3IiOiJ7XCJuYW1lXCI6XCJhdXRob3JfbWVcIixcImFyZ3NcIjpcIlwifSJ9

Most popular content viewed by your profileJSON: {“interacted_posts”:”{\”name\”:\”interacted_posts\”,\”args\”:\”\”}”}Base64: eyJpbnRlcmFjdGVkX3Bvc3RzIjoie1wibmFtZVwiOlwiaW50ZXJhY3RlZF9wb3N0c1wiLFwiYXJnc1wiOlwiXCJ9In0=

Most popular content posted by your friendsJSON: {“rp_author”:”{\”name\”:\”author_friends_feed\”,\”args\”:\”\”}”}Base64: eyJycF9hdXRob3IiOiJ7XCJuYW1lXCI6XCJhdXRob3JfZnJpZW5kc19mZWVkXCIsXCJhcmdzXCI6XCJcIn0ifQ==

Most popular content from the pages you like or the groups you are a member ofJSON: {“rp_author”:”{\”name\”:\”my_groups_and_pages_posts\”,\”args\”:\”\”}”}Base64: eyJycF9hdXRob3IiOiJ7XCJuYW1lXCI6XCJteV9ncm91cHNfYW5kX3BhZ2VzX3Bvc3RzXCIsXCJhcmdzXCI6XCJcIn0ifQ==

Most popular content in the groups you are a member ofJSON: {“rp_group”:”{\”name\”:\”my_groups_posts\”,\”args\”:\”\”}”}Base64: eyJycF9ncm91cCI6IntcIm5hbWVcIjpcIm15X2dyb3Vwc19wb3N0c1wiLFwiYXJnc1wiOlwiXCJ9In0=

Most popular content from a specific pageWarning: you’ll need the Facebook ID of the page of interest. Replace ‘PutIDHere’ with that ID number.JSON: {“rp_author”:”{\”name\”:\”author\”,\”args\”:\”PutIDHere\”}”}Base64: Depends on the ID used.

Most popular content from a specific groupWarning: you’ll need the Facebook ID of the page of interest. Replace ‘PutIDHere’ with that ID number.JSON: {“rp_group”:”{\”name\”:\”group_posts\”,\”args\”:\”PutIDHere\”}”}Base64: Depends on the ID used.

Most popular content tagged with a specific locationWarning: you’ll need the Facebook ID of the page of interest. Replace ‘PutIDHere’ with that ID number.JSON: {“rp_location”:”{\”name\”:\”location\”,\”args\”:\”PutIDHere\”}”}Base64: Depends on the ID used.

Most popular content posted within a specific time rangeWarning: you’ll have to change the time range. You can change the highlighted parts to your liking. JSON: {“rp_creation_time”:”{\”name\”:\”creation_time\”,\”args\”:\”{\\\”start_year\\\”:\\\”2019\\\”,\\\”start_month\\\”:\\\”2019-1\\\”,\\\”end_year\\\”:\\\”2019\\\”,\\\”end_month\\\”:\\\”2019-12\\\”,\\\”start_day\\\”:\\\”2019-1-1\\\”,\\\”end_day\\\”:\\\”2019-12-31\\\”}\”}”}Base64: Depends on the time range used.

Posts from the pages you like and the groups you are a member ofJSON: {“rp_author”:”{\”name\”:\”my_groups_and_pages_posts\”,\”args\”:\”\”}”}Base64: eyJycF9hdXRob3IiOiJ7XCJuYW1lXCI6XCJteV9ncm91cHNfYW5kX3BhZ2VzX3Bvc3RzXCIsXCJhcmdzXCI6XCJcIn0ifQ==

Posts in the groups you are a member ofJSON: {“rp_group”:”{\”name\”:\”my_groups_posts\”,\”args\”:\”\”}”}Base64: eyJycF9ncm91cCI6IntcIm5hbWVcIjpcIm15X2dyb3Vwc19wb3N0c1wiLFwiYXJnc1wiOlwiXCJ9In0=

Posts from a specific pageWarning: you’ll need the Facebook ID of the page of interest. Replace ‘PutIDHere’ with that ID number.JSON: {“rp_author”:”{\”name\”:\”author\”,\”args\”:\”PutIDHere\”}”}Base64: Depends on the ID used.

Posts from a specific groupWarning: you’ll need the Facebook ID of the page of interest. Replace ‘PutIDHere’ with that ID number.JSON: {“rp_group”:”{\”name\”:\”group_posts\”,\”args\”:\”PutIDHere\”}”}Base64: Depends on the ID used.

Public posts tagged with a specific locationWarning: you’ll need the Facebook ID of the page of interest. Replace ‘PutIDHere’ with that ID number.JSON: {“rp_location”:”{\”name\”:\”location\”,\”args\”:\”PutIDHere\”}”}Base64: Depends on the ID used.

Public posts within a specific time rangeWarning: you’ll have to change the time range. You can change the highlighted parts to your liking. JSON: {“rp_creation_time”:”{\”name\”:\”creation_time\”,\”args\”:\”{\\\”start_year\\\”:\\\”2019\\\”,\\\”start_month\\\”:\\\”2019-1\\\”,\\\”end_year\\\”:\\\”2019\\\”,\\\”end_month\\\”:\\\”2019-12\\\”,\\\”start_day\\\”:\\\”2019-1-1\\\”,\\\”end_day\\\”:\\\”2019-12-31\\\”}\”}”}Base64: Depends on the time range used.

Search/people/ (search for people)

People within a specific cityWarning: you’ll need the Facebook ID of the page of interest. Replace ‘PutIDHere’ with that ID number.JSON: {“city”:”{\”name\”:\”users_location\”,\”args\”:\”PutIDHere\”}”}Base64: Depends on the ID used.

People with a specific educationWarning: you’ll need the Facebook ID of the page of interest. Replace ‘PutIDHere’ with that ID number.JSON: {“school”:”{\”name\”:\”users_school\”,\”args\”:\”PutIDHere\”}”}Base64: Depends on the ID used.

People who work at a specific employerWarning: you’ll need the Facebook ID of the page of interest. Replace ‘PutIDHere’ with that ID number.JSON: {“employer”:”{\”name\”:\”users_employer\”,\”args\”:\”PutIDHere\”}”}Base64: Depends on the ID used.

Find friends of a specific profileWarning: you’ll need the Facebook ID of the page of interest. Replace ‘PutIDHere’ with that ID number.JSON: {“friends”:”{\”name\”:\”users_friends_of_people\”,\”args\”:\”PutIDHere\”}”}Base64: Depends on the ID used.

Photos posted by the pages you like and the groups you are a member ofJSON: {“rp_author”:”{\”name\”:\”my_groups_and_pages_posts\”,\”args\”:\”\”}”}Base64: eyJycF9hdXRob3IiOiJ7XCJuYW1lXCI6XCJteV9ncm91cHNfYW5kX3BhZ2VzX3Bvc3RzXCIsXCJhcmdzXCI6XCJcIn0ifQ==

Photos posted by the groups you are a member ofJSON: {“rp_group”:”{\”name\”:\”my_groups_posts\”,\”args\”:\”\”}”}Base64: eyJycF9ncm91cCI6IntcIm5hbWVcIjpcIm15X2dyb3Vwc19wb3N0c1wiLFwiYXJnc1wiOlwiXCJ9In0=

Photos posted by a specific pageWarning: you’ll need the Facebook ID of the page of interest. Replace ‘PutIDHere’ with that ID number.JSON: {“rp_author”:”{\”name\”:\”author\”,\”args\”:\”PutIDHere\”}”}Base64: Depends on the ID used.

Photos posted by a specific groupWarning: you’ll need the Facebook ID of the page of interest. Replace ‘PutIDHere’ with that ID number.JSON: {“rp_group”:”{\”name\”:\”group_posts\”,\”args\”:\”PutIDHere\”}”}Base64: Depends on the ID used.

Photos tagged with a specific locationWarning: you’ll need the Facebook ID of the page of interest. Replace ‘PutIDHere’ with that ID number.JSON: {“rp_location”:”{\”name\”:\”location\”,\”args\”:\”PutIDHere\”}”}Base64: Depends on the ID used.

Photos posted within a specific time rangeWarning: you’ll have to change the time range. You can change the highlighted parts to your liking. JSON: {“rp_creation_time”:”{\”name\”:\”creation_time\”,\”args\”:\”{\\\”start_year\\\”:\\\”2019\\\”,\\\”start_month\\\”:\\\”2019-1\\\”,\\\”end_year\\\”:\\\”2019\\\”,\\\”end_month\\\”:\\\”2019-12\\\”,\\\”start_day\\\”:\\\”2019-1-1\\\”,\\\”end_day\\\”:\\\”2019-12-31\\\”}\”}”}Base64: Depends on the time range used.

Videos posted by your friends and the groups you are a member ofJSON: {“videos_source”:”{\”name\”:\”videos_feed\”,\”args\”:\”\”}”}Base64: eyJ2aWRlb3Nfc291cmNlIjoie1wibmFtZVwiOlwidmlkZW9zX2ZlZWRcIixcImFyZ3NcIjpcIlwifSJ9

Videos tagged to a specific locationWarning: you’ll need the Facebook ID of the page of interest. Replace ‘PutIDHere’ with that ID number.JSON: {“rp_location”:”{\”name\”:\”location\”,\”args\”:\”PutIDHere\”}”}Base64: Depends on the ID used.

Videos posted within a specific time rangeWarning: you’ll have to change the time range. You can change the highlighted parts to your liking. JSON: {“rp_creation_time”:”{\”name\”:\”creation_time\”,\”args\”:\”{\\\”start_year\\\”:\\\”2019\\\”,\\\”start_month\\\”:\\\”2019-1\\\”,\\\”end_year\\\”:\\\”2019\\\”,\\\”end_month\\\”:\\\”2019-12\\\”,\\\”start_day\\\”:\\\”2019-1-1\\\”,\\\”end_day\\\”:\\\”2019-12-31\\\”}\”}”}Base64: Depends on the time range used.

Search/pages (search for pages)

Search for pages of local business or places JSON: {“category”:”{\”name\”:\”pages_category\”,\”args\”:\”1006\”}”}Base64: eyJjYXRlZ29yeSI6IntcIm5hbWVcIjpcInBhZ2VzX2NhdGVnb3J5XCIsXCJhcmdzXCI6XCIxMDA2XCJ9In0=

Search for pages of companies, organisations or institutionsJSON: {“category”:”{\”name\”:\”pages_category\”,\”args\”:\”1013\”}”}Base64: eyJjYXRlZ29yeSI6IntcIm5hbWVcIjpcInBhZ2VzX2NhdGVnb3J5XCIsXCJhcmdzXCI6XCIxMDEzXCJ9In0=

Search for pages of a brand or a productJSON: {“category”:”{\”name\”:\”pages_category\”,\”args\”:\”1009\”}”}Base64: eyJjYXRlZ29yeSI6IntcIm5hbWVcIjpcInBhZ2VzX2NhdGVnb3J5XCIsXCJhcmdzXCI6XCIxMDA5XCJ9In0=

Search for pages of artists, bands or public figuresJSON: {“category”:”{\”name\”:\”pages_category\”,\”args\”:\”1007,180164648685982\”}”}Base64: eyJjYXRlZ29yeSI6IntcIm5hbWVcIjpcInBhZ2VzX2NhdGVnb3J5XCIsXCJhcmdzXCI6XCIxMDA3LDE4MDE2NDY0ODY4NTk4MlwifSJ9

Search for pages of a cause or a communityJSON: {“category”:”{\”name\”:\”pages_category\”,\”args\”:\”2612\”}”}Base64: eyJjYXRlZ29yeSI6IntcIm5hbWVcIjpcInBhZ2VzX2NhdGVnb3J5XCIsXCJhcmdzXCI6XCIyNjEyXCJ9In0=

Search/places

According to @djnemec blog he hasn’t figured this option out yet. I haven’t either. When looking at ‘Places’ you have a couple of filtering options, but nothing that can be translate from/to Base64. If you’ve looked into this and found the solution, we’d love to know!

I get errors when executing the queries

You probably get either a blank page or a page that says that the page doesn’t exists. If you get a blank page, you’re doing something wrong in the query. This means that, for example, you’ve tried to search for ‘Most recent’ in the category ‘People’, which is not possible. Check to see if you’ve selected the right category and the right query. Rebuild your query just to be sure.If you’re seeing the ‘This page does not exists”-error; this means that you’ve misspelled something in your query. Check if you’ve copied the right Base64 line, used the right base URL as mentioned above, did not accidentally removed a character somewhere and read the query character for character.

Here I made a mistake in the base URL; it should have been:‘/?q=baseball”Because I forgot the question mark, my query didn’t work.

There is a chance you’re getting errors while everything is spelled correctly. This might have to do with the fact that the quotations in your JSON string aren’t straight but slightly tilted. Make sure you use the straight quotations.

Combining the queries

So far so good right? So if you’ve managed to get this far, we’re going to step it up a notch: we’re going to combine queries. This way you can, for example, search for everyone named ‘John’, who live in ‘Mountain View, California’ and work for ‘Google’. This will be all featured in the next blog.If you’re ready, press here to continue and read the second part!